Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects potential data exfiltration attempts via a GitHub repository push. It specifically looks for HTTP POST requests to 'github.com' with the URI '/git-receive-pack' and a data size greater than 10000 bytes. This pattern is indicative of a 'git push' operation, which could be used to upload sensitive data to a public or controlled GitHub repository.
This rule detects a potential SMS Pumping Attack, specifically targeting bulk One-Time Password (OTP) requests. It triggers when a single source IP address makes more than 50 HTTP POST requests to a URI containing "send_sms" within a 60-second window. This behavior is indicative of an attacker attempting to exploit SMS delivery systems by repeatedly requesting OTPs, potentially leading to financial costs for the service provider or overwhelming users with messages.
This rule detects multiple HTTP requests to 'iam.amazonaws.com' with the URI containing 'DeleteAccessKey'. This activity, especially when occurring frequently (5 times in 30 seconds from the same source), could indicate an attempt to revoke cloud account access keys, potentially as part of a lockout impact attack.
This rule detects attempts to execute a system reboot command via a web shell. It specifically looks for the case-insensitive string "reboot" within the HTTP URI of established client-to-server HTTP traffic. This activity is indicative of an attacker who has gained control over a web server and is using a web shell to issue system-level commands, potentially to disrupt services or cover tracks.
This rule detects potential banking web inject form overlays by looking for specific keywords in HTTP response data. It triggers when an HTTP response contains 'account_number', 'routing_number', and 'XMLHttpRequest' (all case-insensitive). This combination of keywords suggests an attempt to inject malicious forms into a legitimate banking website to steal credentials or financial information.
This rule detects HTTP POST requests that are likely associated with financial transaction hijacking by banking Trojans. It specifically looks for HTTP POST requests where the host header or URI contains keywords related to banking or payment services (bank, paypal, stripe, wise, transferwise) and the URI also contains the word 'transfer'. Additionally, the request body size must be greater than 200 bytes, indicating a substantial data transfer, which is common in financial transactions.
This rule detects the delivery of a potential ransomware MBR (Master Boot Record) wiper payload via HTTP. It specifically looks for HTTP responses containing file data that starts with the byte sequence '55 AA' (which often indicates a boot sector or MBR) and also contains 'MZ' (the DOS executable signature), with a file size greater than 10,000 bytes. This combination suggests a malicious executable designed to overwrite the MBR, a common tactic used by certain types of ransomware or disk wipers.
This rule detects HTTP access to domains or hosts associated with bulletproof hosting infrastructure. It specifically looks for hostnames containing '.ru/', '.cn/', 'frantech', 'serverius', or 'combahton'. A threshold of 5 occurrences within 60 seconds from the same source IP triggers the alert.
This rule detects HTTP POST requests with a client body that appears to be RC4 symmetric encrypted C2 beacon traffic. It specifically looks for HTTP traffic flowing to the server, with a client body between 100 and 500 bytes in size, and whose content matches a PCRE regex for base64 encoded strings. The rule is thresholded to trigger if 20 such events occur from the same source IP within 60 seconds, indicating potential beaconing activity.
This rule detects potential data exfiltration of removable media file contents over HTTP. It specifically looks for HTTP POST requests to a URI containing "upload" with a payload size greater than 50,000 bytes. A threshold is applied to prevent excessive alerts, triggering if 5 such events occur from the same source within 60 seconds.
This rule detects the upload of a malicious executable file (identified by the 'MZ' header) to a SharePoint server via the REST API endpoint for folder manipulation. Specifically, it looks for HTTP POST requests to URIs containing '/_api/web/getfolderbyserverrelativeurl' with file data that starts with 'MZ'. This indicates an attempt to upload an executable file, potentially for lateral movement or further compromise within a SharePoint environment.
This rule detects network traffic where an HTTP request is made to 'ssm.amazonaws.com' with the URI containing 'StartSession'. This combination indicates the initiation of an AWS Systems Manager (SSM) Session Manager session, which can be used for legitimate remote administration but also for lateral movement by attackers.
This rule detects a high volume of requests to download repository archives from a GitLab instance. Specifically, it triggers when 10 or more HTTP requests containing '/repository/archive' in the URI and 'gitlab.' in the HTTP host header are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate data by bulk downloading repository contents.
This rule detects potential bulk downloads from SharePoint document libraries. It triggers when a client makes 30 or more HTTP requests to a SharePoint API endpoint related to web lists ('/_api/web/lists') within a 60-second window. This behavior can indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects bulk harvesting of Microsoft Teams messages via the Graph API. It triggers when a client makes 20 or more HTTP requests within 60 seconds to graph.microsoft.com with URIs containing both '/teams/' and '/messages'. This behavior could indicate an attempt to exfiltrate a large volume of communication data from Microsoft Teams.
This rule detects potential data exfiltration of screen window lists via HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the case-insensitive string "windows" and the data size is greater than 200 bytes. This combination suggests an attempt to send information about open windows on a system to a remote server.
This rule detects attempts to enumerate USB and peripheral devices on a Windows system via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'Win32_USBHub' in the URI, indicating a WMI query to list USB devices. This activity is often associated with discovery tactics by attackers who have gained initial access to a system.
This rule detects potential Office 365 email account enumeration attempts via the Microsoft Graph API. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with URIs containing both '/users/' and '/mailboxSettings'. This pattern is indicative of an attacker attempting to discover valid user accounts and their mailbox settings.
This rule detects attempts to enumerate AWS IAM groups via the 'ListGroups' API call. It specifically looks for HTTP traffic directed to 'iam.amazonaws.com' with 'ListGroups' in the URI, indicating a potential reconnaissance activity against AWS Identity and Access Management.
This rule detects when an attacker enumerates Azure AD group memberships via the Microsoft Graph API. It specifically looks for HTTP requests to 'graph.microsoft.com' with URI paths containing '/groups/' and '/members', indicating an attempt to list group members. A threshold is applied to detect a burst of such requests from a single source.
This rule detects HTTP requests to a Docker daemon's API endpoint (port 2375) specifically targeting the '/networks' URI. This indicates an attempt to enumerate Docker network resources, which could be part of a reconnaissance phase by an attacker to understand the containerized environment.
Page 78 of 116